Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3SETUP.bat
windows7-x64
7SETUP.bat
windows10-2004-x64
6UPGRADE.bat
windows7-x64
1UPGRADE.bat
windows10-2004-x64
1postgresql...nt.msi
windows7-x64
7postgresql...nt.msi
windows10-2004-x64
7postgresql-8.3.msi
windows7-x64
7postgresql-8.3.msi
windows10-2004-x64
7vcredist_x86.exe
windows7-x64
7vcredist_x86.exe
windows10-2004-x64
7Analysis
-
max time kernel
120s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
07/11/2023, 13:52
Static task
static1
Behavioral task
behavioral1
Sample
SETUP.bat
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral2
Sample
SETUP.bat
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
UPGRADE.bat
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral4
Sample
UPGRADE.bat
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
postgresql-8.3-int.msi
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral6
Sample
postgresql-8.3-int.msi
Resource
win10v2004-20231025-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
postgresql-8.3.msi
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral8
Sample
postgresql-8.3.msi
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
vcredist_x86.exe
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral10
Sample
vcredist_x86.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
General
-
Target
postgresql-8.3.msi
-
Size
157KB
-
MD5
9bd95420958b9c6773f86cd061eec0e2
-
SHA1
f2201c71555875f8368bed067f4bdccd115a02ea
-
SHA256
5322707fb675f25ce085eaafce716cb2428d509416bd8bc5bdaf68f846442ea6
-
SHA512
c9bde16c945870879e6537007669155116fda18a52737218261bec3d94c16b22bceed5d109647e454c9bdc67fa9f48a4fb99ffdbfea20db11ae9704b42c15deb
-
SSDEEP
1536:o4LjxwVJrjCQJZbrOt+sa/lTREfOcqDp:bLSI6POtra/lTR
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2844 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3036 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3036 msiexec.exe Token: SeIncreaseQuotaPrivilege 3036 msiexec.exe Token: SeRestorePrivilege 2940 msiexec.exe Token: SeTakeOwnershipPrivilege 2940 msiexec.exe Token: SeSecurityPrivilege 2940 msiexec.exe Token: SeCreateTokenPrivilege 3036 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3036 msiexec.exe Token: SeLockMemoryPrivilege 3036 msiexec.exe Token: SeIncreaseQuotaPrivilege 3036 msiexec.exe Token: SeMachineAccountPrivilege 3036 msiexec.exe Token: SeTcbPrivilege 3036 msiexec.exe Token: SeSecurityPrivilege 3036 msiexec.exe Token: SeTakeOwnershipPrivilege 3036 msiexec.exe Token: SeLoadDriverPrivilege 3036 msiexec.exe Token: SeSystemProfilePrivilege 3036 msiexec.exe Token: SeSystemtimePrivilege 3036 msiexec.exe Token: SeProfSingleProcessPrivilege 3036 msiexec.exe Token: SeIncBasePriorityPrivilege 3036 msiexec.exe Token: SeCreatePagefilePrivilege 3036 msiexec.exe Token: SeCreatePermanentPrivilege 3036 msiexec.exe Token: SeBackupPrivilege 3036 msiexec.exe Token: SeRestorePrivilege 3036 msiexec.exe Token: SeShutdownPrivilege 3036 msiexec.exe Token: SeDebugPrivilege 3036 msiexec.exe Token: SeAuditPrivilege 3036 msiexec.exe Token: SeSystemEnvironmentPrivilege 3036 msiexec.exe Token: SeChangeNotifyPrivilege 3036 msiexec.exe Token: SeRemoteShutdownPrivilege 3036 msiexec.exe Token: SeUndockPrivilege 3036 msiexec.exe Token: SeSyncAgentPrivilege 3036 msiexec.exe Token: SeEnableDelegationPrivilege 3036 msiexec.exe Token: SeManageVolumePrivilege 3036 msiexec.exe Token: SeImpersonatePrivilege 3036 msiexec.exe Token: SeCreateGlobalPrivilege 3036 msiexec.exe Token: SeCreateTokenPrivilege 3036 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3036 msiexec.exe Token: SeLockMemoryPrivilege 3036 msiexec.exe Token: SeIncreaseQuotaPrivilege 3036 msiexec.exe Token: SeMachineAccountPrivilege 3036 msiexec.exe Token: SeTcbPrivilege 3036 msiexec.exe Token: SeSecurityPrivilege 3036 msiexec.exe Token: SeTakeOwnershipPrivilege 3036 msiexec.exe Token: SeLoadDriverPrivilege 3036 msiexec.exe Token: SeSystemProfilePrivilege 3036 msiexec.exe Token: SeSystemtimePrivilege 3036 msiexec.exe Token: SeProfSingleProcessPrivilege 3036 msiexec.exe Token: SeIncBasePriorityPrivilege 3036 msiexec.exe Token: SeCreatePagefilePrivilege 3036 msiexec.exe Token: SeCreatePermanentPrivilege 3036 msiexec.exe Token: SeBackupPrivilege 3036 msiexec.exe Token: SeRestorePrivilege 3036 msiexec.exe Token: SeShutdownPrivilege 3036 msiexec.exe Token: SeDebugPrivilege 3036 msiexec.exe Token: SeAuditPrivilege 3036 msiexec.exe Token: SeSystemEnvironmentPrivilege 3036 msiexec.exe Token: SeChangeNotifyPrivilege 3036 msiexec.exe Token: SeRemoteShutdownPrivilege 3036 msiexec.exe Token: SeUndockPrivilege 3036 msiexec.exe Token: SeSyncAgentPrivilege 3036 msiexec.exe Token: SeEnableDelegationPrivilege 3036 msiexec.exe Token: SeManageVolumePrivilege 3036 msiexec.exe Token: SeImpersonatePrivilege 3036 msiexec.exe Token: SeCreateGlobalPrivilege 3036 msiexec.exe Token: SeCreateTokenPrivilege 3036 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3036 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2844 2940 msiexec.exe 29 PID 2940 wrote to memory of 2844 2940 msiexec.exe 29 PID 2940 wrote to memory of 2844 2940 msiexec.exe 29 PID 2940 wrote to memory of 2844 2940 msiexec.exe 29 PID 2940 wrote to memory of 2844 2940 msiexec.exe 29 PID 2940 wrote to memory of 2844 2940 msiexec.exe 29 PID 2940 wrote to memory of 2844 2940 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\postgresql-8.3.msi1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3036
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7DF1A0A5432257DFA1E917298186F3E1 C2⤵
- Loads dropped DLL
PID:2844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5246c2abfdfc0c728eaac835d7733e2b7
SHA1b60eed815ce8f0e096cef0483083834ab05de022
SHA2563569d3af32012dc51422b37be3ff838bae3d5f4412bd60b57fd2c0ce3c2180ff
SHA51243d63f7969854e2cdda78d0a724aaa5eb2200228b4c44cc74c73108ce7aede7af85fc463d8967a3f9a9cdfab1bcc0ee171b343972f4608e6324618f35c362bae
-
Filesize
48KB
MD5246c2abfdfc0c728eaac835d7733e2b7
SHA1b60eed815ce8f0e096cef0483083834ab05de022
SHA2563569d3af32012dc51422b37be3ff838bae3d5f4412bd60b57fd2c0ce3c2180ff
SHA51243d63f7969854e2cdda78d0a724aaa5eb2200228b4c44cc74c73108ce7aede7af85fc463d8967a3f9a9cdfab1bcc0ee171b343972f4608e6324618f35c362bae